System and method for analyzing a device

Abstract

A system and method for analyzing a device are disclosed. In an aspect, a method can comprise determining a parameter of a device at a kernel level of a software stack associated with the device, analyzing the parameter to determine an event state, comparing the event state to a white list to determine a state of an alert trigger, and generating an alert in response to the determined state of the alert trigger.

What is claimed is: 
     
       1. A method comprising:
 determining, a physical pattern of operation associated with a device; 
 determining, based on one or more acceptable patterns of operation of the device, that the physical pattern of operation associated with the device is associated with a pattern of operation corresponding to a security issue; 
 determining, based on the physical pattern of operation associated with the device being associated with the pattern of operation corresponding to the security issue, one or more remediation measures; and 
 causing the device to implement the one or more remediation measures. 
 
     
     
       2. The method of  claim 1 , wherein causing the device to implement the one or more remediation measures comprises sending an indication of the one or more remediation measures to the device. 
     
     
       3. The method of  claim 1 , wherein the pattern of operation corresponding to the security issue comprises one or more of an unauthorized interaction with a hardware interface associated with the device, one or more unauthorized secure shell (SSH) commands, or one or more unauthorized Telnet commands. 
     
     
       4. The method of  claim 1 , wherein determining the pattern of operation associated with the device comprises determining a change to an operational process of the device. 
     
     
       5. The method of  claim 1 , wherein the one or more remediation measures comprise changing one or more services associated with the device. 
     
     
       6. The method of  claim 1 , wherein the one or more remediation measures comprise suspending one or more services associated with the device. 
     
     
       7. The method of  claim 1 , wherein the pattern of operation corresponding to the security issue comprises a pattern of physical events. 
     
     
       8. The method of  claim 1 , wherein determining the pattern of operation associated with the device comprises receiving the pattern of operation from the device. 
     
     
       9. A method comprising:
 determining a parameter indicating a pattern of operation associated with a device; 
 determining a change in the parameter; 
 determining, based on one or more of the parameter or the change in the parameter, a physical pattern of operation associated with the device; 
 determining that the physical pattern of operation associated with the device is associated with a pattern of operation corresponding to a security issue; 
 determining, based on determining that the physical pattern of operation associated with the device is associated with the pattern of operation corresponding to the security issue, one or more remediation measures; and 
 causing the device to implement the one or more remediation measures. 
 
     
     
       10. The method of  claim 9 , wherein causing the device to implement the one or more remediation measures comprises sending an indication of the one or more remediation measures to the device. 
     
     
       11. The method of  claim 9 , wherein the pattern of operation corresponding to the security issue comprises one or more of an unauthorized interaction with a hardware interface associated with the device, one or more unauthorized secure shell (SSH) commands, or one or more unauthorized Telnet commands. 
     
     
       12. The method of  claim 9 , wherein the one or more remediation measures comprise changing one or more services associated with the device. 
     
     
       13. The method of  claim 9 , wherein the one or more remediation measures comprise suspending one or more services associated with the device. 
     
     
       14. A method comprising:
 determining a parameter indicating a physical pattern of operation associated with a device; 
 determining, based on the parameter, a security issue; 
 determining, based on the security issue, an alert; and 
 determining, based on the alert, an alert priority. 
 
     
     
       15. The method of  claim 14 , further comprising determining, by a detection element embedded in a software stack associated with the device, the parameter. 
     
     
       16. The method of  claim 14 , wherein determining the parameter comprises determining a change to an internal process associated with the device. 
     
     
       17. The method of  claim 14 , further comprising determining, based on the alert priority, one or more remediation measures. 
     
     
       18. The method of  claim 14 , further comprising determining, based on one or more of an unauthorized interaction with a hardware interface associated with the device, one or more unauthorized secure shell (SSH) commands, or one or more unauthorized Telnet commands, a change to the parameter. 
     
     
       19. The method of  claim 17 , further comprising causing the device to implement the one or more remediation measures. 
     
     
       20. The method of  claim 17 , wherein the one or more remediation measures comprise at least one of suspending a service associated with the device or changing one or more services associated with the device.